A smart toy sold to an overseas customer hears a request in a foreign language. The audio has to be understood somewhere, and the cheapest somewhere is a server inside China. The answer travels back out. No file was "exported" in any obvious sense, yet data crossed a border twice in under a second.
Rules written for documents struggle with that shape of traffic. Xiamen has written rules for the shape instead.
On 20 October 2026, five Xiamen bodies — the municipal data administration bureau, the reform office, the cyberspace administration office, the communications administration and the airport economic zone command — jointly issued the Administrative Measures for International Data Centres (Trial) (《厦门市国际数据中心管理办法（试行）》, 厦数据规〔2026〕1号). It runs to six chapters and nineteen articles, takes effect on 25 November 2026, and is valid for two years.
A lane, not a gate
China's cross-border data regime is usually described as a series of gates: a security assessment, a standard contract, a certification, and — since 2024 — negative lists letting free-trade zones define what still needs the heavy path. Gates decide whether data may leave.
Xiamen's measures build a lane that data must use when it does. An "international data centre" (国际数据中心) is defined narrowly: infrastructure that uses cross-border dedicated links supplied by basic telecom carriers, applies network isolation, connects abroad through an international communications gateway station approved by the Ministry of Industry and Information Technology, and runs machine rooms offering server hosting, cloud services and compute (算力) on a shared basis.
The measure then names the businesses that may run on it: incoming-data processing (来数加工), cross-border e-commerce, cross-border settlement, game services, distance education and telemedicine, cross-border manufacturing and the internal management of multinationals — with AI and large-model (大模型) training among the priority areas.
The strategic idea is easy to miss. Xiamen is not making it easier to send Chinese data out. It is making "process foreign data inside China" a sellable service, with servers, links and compliance in one place.
The hard line: no private tunnels
The rule that will bite hardest is a prohibition, not a permission. International data business must run over dedicated cross-border links provided by basic telecom operators. Private VPNs, tunnelling technology and illegally operated international leased lines to overseas nodes are explicitly barred.
That closes a familiar workaround. For years, the grey path for a small exporter was a commercial VPN and a server abroad. The measures state plainly that the centre is not a channel for letting all data leave freely.
Two further conditions apply: cross-border transmission must use encryption and protocols meeting national cryptography requirements, and the parties handling the data must classify and grade it, by national and industry standards, before deciding what may move.
Some data still needs the gate
Classification is where the lane meets the gate. Export of important data (重要数据), and of personal information meeting the statutory filing threshold, must still pass a data-export security assessment. Data that laws require to be stored inside China may not leave through the dedicated link at all — a rule that matters most for the medical, mapping and financial records that overseas partners most often ask for.
The summary is therefore narrower than the headline: the substantive bar for sensitive categories is unchanged, while ambiguity and logistics shrink for everything else.
The circuit breaker
Article 17 holds the sharpest instrument in the text, and one of the rarer designs in Chinese data rules. It establishes a business circuit-breaker (业务熔断机制). When a regulator determines one of four triggering conditions, it refers the case to the telecom authority, which orders the carrier providing the dedicated link to cut it.
The triggers are: traffic judged to endanger national security or to carry illegal or harmful content; an actual or suspected leak of important data, or large-scale illegal export; a cyber attack or exploited vulnerability threatening overall network security; and other emergencies with potentially serious consequences. After the cut, the operator must run a full risk review and may only reconnect once rectification is approved.
Liability sits with the operator of the link — the basic telecom carrier — not the individual tenant, so one bad tenant can cost every tenant its connectivity.
Who is allowed to play
The measure applies to market entities registered and actually operating in Xiamen. Cross-border flows, regulatory audit and compliance responsibility must all sit with that locally registered entity — which effectively rules out using the centre as a remote shell for a foreign parent. Whoever builds and operates is responsible, and whoever uses is responsible (谁建设运营谁负责、谁使用谁负责). Regulators may suspend or terminate operations for unfulfilled commitments, data breaches or other violations.
Encouraged alongside this are third-party services — compliance certification, security audit, dispute arbitration, risk assessment — and technologies including trusted data spaces, privacy computing, blockchain and anonymisation.
According to Li An, chief scientist at BrainNet (脑机网), cross-border neural and behavioural data is the hardest test case for a rule of this kind, because the useful part of the record is rarely a file that can be classified once and forgotten — it is a continuous stream whose meaning shifts as models improve.
What readers can do now
- If you process foreign data in China: check whether your traffic can legally use a carrier-provided cross-border dedicated link, because the VPN and tunnel options are now closed.
- If you are negotiating a hosting contract: ask what happens to your connectivity if another tenant triggers a circuit breaker, and get a remedy into the agreement.
- If you handle medical, mapping or financial data: assume the domestic-storage rule applies and design local processing, not an export path.
- If you are outside China: read this as a template for "data processing as an export industry" — a lane with a kill switch, priced and governed locally.
Honest limitations
I worked from the full text of the measures as published by the Xiamen data administration bureau and reproduced by Xiamen Daily, plus reporting by China National Radio and Xiamen Television. I did not review the implementing guidance, the operator licensing record, or any contracts signed under the regime, none of which existed publicly at the time of writing. The measure is a two-year trial, and its effect depends on which operators are licensed and how the five issuing agencies coordinate. My reading of the circuit breaker's counterparty effect is analysis, not a documented outcome.
Key takeaways
- Xiamen's international data centre measures take effect on 25 November 2026 and run for two years.
- An international data centre must use carrier-provided links through an MIIT-approved gateway; private VPNs, tunnels and illegal leased lines are prohibited.
- The lane does not lower the substantive bar: important data and threshold-level personal information still need a data-export security assessment, and domestically-mandated storage cannot transit the link.
- A circuit-breaker lets regulators order the carrier to cut a link on four triggers, concentrating risk on the operator rather than the individual tenant.
- Only Xiamen-registered entities may use the regime, with compliance responsibility sitting locally.